Post #23679 63 Oct 12, 2026, 09:10 UTC Google paid me $90,000 for this RCEhttps://simonkoeck.com/writeups/google-devsite-flask-session-pickle-rce@secharvester Simon Koeck How I Found a $90,000 Remote Code Execution Vulnerability in Google | Simon Koeck A Flask cookie on developers.google.com was signed with a secret it was also carrying inside itself. Pulling that secret out turned a forged session into code execution across seven Google domains.